Problem:

The customer wanted to allow coaches, defined as CPTs, to edit their own records using Toolset Forms. He explored two potential methods but was unsure how to implement them using Toolset, especially since he uses the legacy version of Views. The primary challenge was to ensure each coach could only edit their own record without using the standard WordPress authentication system.

Solution:

We suggested using a unique URL with a secret parameter to allow coaches to access and edit their records. The steps include:

Adding a custom field (coach_secret) to each coach's profile.
Generating and sending a unique URL to each coach containing the secret parameter.
Creating a custom shortcode to handle the secret verification and display the form pre-filled with the coach's details.
Implementing a custom function to validate the secret parameter against the coach_secret field.
Here is a simplified version of the custom code used:

add_shortcode('show_edit_coach_form', function() {
    if (isset($_GET['secret'])) {
        $secret = sanitize_text_field($_GET['secret']);
        $args = array(
            'post_type' => 'coach',
            'meta_query' => array(
                array(
                    'key' => 'wpcf-secret',
                    'value' => $secret,
                    'compare' => '='
                )
            )
        );
        $query = new WP_Query($args);
        if ($query->have_posts()) {
            while ($query->have_posts()) {
                $query->the_post();
                $post_id = get_the_ID();
                echo do_shortcode('[cred_form form="edit-coach-form" post="' . $post_id . '"]');
            }
            wp_reset_postdata();
        } else {
            echo 'Invalid URL or no matching coach found.';
        }
    } else {
        echo 'No URL parameter provided.';
    }
});